8a105bae4505c2cdf74b94fca49c65ce0f858e22da05ec5e82508534838bdcf2

General

Target

53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
Size

45KB
MD5

53e69f66805fb012bdb69820b0466e90
SHA1

20af9835c07f1fbb22d3d6e683fe4e113d0668ee
SHA256

8a105bae4505c2cdf74b94fca49c65ce0f858e22da05ec5e82508534838bdcf2
SHA512

faaedea24b383c7a9f76076aea1e0051d05edf113b7ab4dc646a2f6c6682c0e2710d18befba4fdf8ce80cdcba00b3f14c43075d45677bd1a14dceabf3a67b346
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAvL4:CTWn1++PJHJXA/OsIZfzc3/QuLX8/8s

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5045) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3308-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/3308-1104-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\FindClear.mp3.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\am.pak.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Resources.pri.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\ConfirmConvertFrom.temp.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\meta-index.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Logo.png.tmp	53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\53e69f66805fb012bdb69820b0466e90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp
Filesize
45KB

MD5
e4d7814e9955622978823d6f6207038c

SHA1
6e91102107b4bd0fcd7547ce76e9ace4772e7ade

SHA256
0d27abb1504f4a4883238a3ffaaeb926270d9f8d438f557bd73942e92b1a3493

SHA512
6669c6b09941af4b9cc16eb31eccb55ed61d28b8701eeae317c17ee5fa84a4a8e47c2f1687e2716af7e7c60d511871c9cc6ab76f023f1bcaefcb3f2d62ac489b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
144KB

MD5
825d791cafd8b6ef3609d128b046859f

SHA1
33a57a2e2c9e61ba1de0aacb358742528a8441c4

SHA256
f52c52d1b483a77698dd4038ea141c7d89bd2a8258d829973b9f262e694c8359

SHA512
637a7c71d8ad417c2deeb1eed295c7bcfed0421e28a8bbfb910047bbc48997d77b3be30095e3260d47fc51cb9aa399e7155983ba10ca0654b8fb655ef5d7776a

Download Submit
memory/3308-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3308-1104-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing